panic in tunstart_l2()

[Kyle Evans]

On Tue, May 14, 2019 at 10:34 AM Kyle Evans <kevans at freebsd.org> wrote:
>
> On Tue, May 14, 2019 at 10:10 AM Mark Johnston <markj at freebsd.org> wrote:
> >
> > Hi,
> >
> > I hit the following panic last night on a non-INVARIANTS kernel at
> > r347549.  The workload involves running a number of bhyve VMs with
> > frequent restarts, during which a tap interface is destroyed and
> > recreated.  I'm a bit short on time to debug this today, so while I
> > retry with INVARIANTS on I thought I'd also report the issue in case
> > anyone else is seeing it.
> >
> > The panic occurred because the ifnet's softc field is NULL.
>
> Ah, foo. I'll have to re-examine the ioctl/destroy race... tun_destroy
> grabs the ioctl sx and kills off the if_softc, but it can not and
> should not do this before if_detach or else things go wrong because
> it's still a part of the bridge.

I'm considering this patch [0] to move destroying the if_softc until
after we've detached. We've already closed the tunnel, dropped all of
our routes/addresses, and detach has freed us of our bridge
responsibilities.

It seems that we could still have a reference to the ifp in the ioctl
path if something's entered just prior to detach, so we kill off the
if_softc prior to freeing and the rest is safe.

[0] https://people.freebsd.org/~kevans/tuntap-bridge.diff